SonarCloud flags every third-party action in this repo as a high-severity supply-chain risk (rule githubactions:S7637): mutable tags like maxim-lobanov/[email protected] and codecov/codecov-action@v4 can be repointed by the owner, or by an attacker who compromises the action repo, and our workflows would silently run different code.
Do these together, not separately. Pinning SHAs without automated bumps just trades a mutable tag for a frozen action that silently rots — the exact failure mode this project is trying to get away from.
Task:
- Add
.github/dependabot.yml covering both github-actions and swift package ecosystems.
- Pin every third-party action to a full commit SHA with a trailing
# vX.Y.Z comment.
Currently unpinned: maxim-lobanov/setup-xcode, codecov/codecov-action, dawidd6/action-homebrew-bump-formula, dawidd6/action-download-artifact, softprops/action-gh-release, peter-evans/create-pull-request, reecetech/version-increment, Apple-Actions/import-codesign-certs, devbotsxyz/xcode-select.
SonarCloud flags every third-party action in this repo as a high-severity supply-chain risk (rule
githubactions:S7637): mutable tags likemaxim-lobanov/[email protected]andcodecov/codecov-action@v4can be repointed by the owner, or by an attacker who compromises the action repo, and our workflows would silently run different code.Do these together, not separately. Pinning SHAs without automated bumps just trades a mutable tag for a frozen action that silently rots — the exact failure mode this project is trying to get away from.
Task:
.github/dependabot.ymlcovering bothgithub-actionsandswiftpackage ecosystems.# vX.Y.Zcomment.Currently unpinned:
maxim-lobanov/setup-xcode,codecov/codecov-action,dawidd6/action-homebrew-bump-formula,dawidd6/action-download-artifact,softprops/action-gh-release,peter-evans/create-pull-request,reecetech/version-increment,Apple-Actions/import-codesign-certs,devbotsxyz/xcode-select.